zhuchaowe/maxkb
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

fix: Add FlibInstance to allowed classes and use restricted_loads for deserialization

Browse Source
This commit is contained in:
CaptainB 2025-03-20 13:53:37 +08:00
parent f19ad24907
commit 47849fc1a5
2 changed files with 4 additions and 2 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

3
apps/common/util/common.py
View File

@ -31,7 +31,8 @@ safe_builtins = {
ALLOWED_CLASSES = { ALLOWED_CLASSES = {
("builtins", "dict"), ("builtins", "dict"),
('uuid', 'UUID'), ('uuid', 'UUID'),
("application.serializers.application_serializers", "MKInstance") ("application.serializers.application_serializers", "MKInstance"),
("function_lib.serializers.function_lib_serializer", "FlibInstance")
} }

3
apps/function_lib/serializers/function_lib_serializer.py
View File

@ -22,6 +22,7 @@ from common.db.search import page_search
from common.exception.app_exception import AppApiException from common.exception.app_exception import AppApiException
from common.field.common import UploadedFileField, UploadedImageField from common.field.common import UploadedFileField, UploadedImageField
from common.response import result from common.response import result
from common.util.common import restricted_loads
from common.util.field_message import ErrMessage from common.util.field_message import ErrMessage
from common.util.function_code import FunctionExecutor from common.util.function_code import FunctionExecutor
from common.util.rsa_util import rsa_long_decrypt, rsa_long_encrypt from common.util.rsa_util import rsa_long_decrypt, rsa_long_encrypt
@ -338,7 +339,7 @@ class FunctionLibSerializer(serializers.Serializer):
user_id = self.data.get('user_id') user_id = self.data.get('user_id')
flib_instance_bytes = self.data.get('file').read() flib_instance_bytes = self.data.get('file').read()
try: try:
flib_instance = pickle.loads(flib_instance_bytes) flib_instance = restricted_loads(flib_instance_bytes)
except Exception as e: except Exception as e:
raise AppApiException(1001, _("Unsupported file format")) raise AppApiException(1001, _("Unsupported file format"))
function_lib = flib_instance.function_lib function_lib = flib_instance.function_lib